Monorepo Public/Internal Split — Plan C: Polish + Full Backlog

find /home/efran -maxdepth 3 -type d -iname "*legal*" -o -iname "*hukum*" -o -iname "*akta*" 2>/dev/null | head -20
find /home/efran -maxdepth 3 -name "*.pdf" -o -name "*.txt" 2>/dev/null | wc -l
ls /home/efran/remote-development/poc-ahu-ai/ 2>/dev/null | grep -i "doc\|legal\|hukum\|ocr"

git add docs/superpowers/rag-corpus-inventory.md
git commit -m "docs(rag): inventory candidate AHU legal doc sources for corpus load"

ssh obert@192.168.83.20 "docker exec ai-ahu-rag curl -s http://milvus:19530/v1/vector/collections 2>&1 | head -5"

ssh obert@192.168.83.20 "curl -sf http://192.168.83.20:8110/health 2>&1 | head -3"

ssh obert@192.168.83.20 "docker exec ai-ahu-rag python -c 'from rag.embed import embed_texts; v = embed_texts([\"apa itu perseroan\"]); print(len(v[0]))'"

ssh obert@192.168.83.20 "docker exec ai-ahu-rag ls /app/rag/scripts/ 2>&1 | head"

# Example — adjust paths based on Task A1 inventory + ai-ahu-rag's actual mount:
rsync -avz /home/efran/remote-development/poc-ahu-ai/<INVENTORY_DIR>/ obert@192.168.83.20:/home/obert/ahu-rag-corpus/source-2026-07/

ssh obert@192.168.83.20 "docker exec ai-ahu-rag python -m rag.scripts.ingest --source /data/source-2026-07 --collection ahu_legal_v1 2>&1 | tail -30"

ssh obert@192.168.83.20 "docker exec ai-ahu-rag python -c 'from rag.milvus import stats; print(stats(\"ahu_legal_v1\"))'"

mkdir -p docs/superpowers/parity-snapshots/2026-07-01-rag-load
echo "ran at $(date -Iseconds)" > docs/superpowers/parity-snapshots/2026-07-01-rag-load/ingest-run.txt
ssh obert@192.168.83.20 "docker exec ai-ahu-rag python -c 'from rag.milvus import stats; print(stats(\"ahu_legal_v1\"))'" >> docs/superpowers/parity-snapshots/2026-07-01-rag-load/ingest-run.txt
git add docs/superpowers/parity-snapshots/2026-07-01-rag-load/
git commit -m "docs(rag): ingest run 2026-07-01 — <N> docs loaded into ahu_legal_v1"

for i in 1 2 3 4 5; do
  case $i in
    1) Q="Apa itu perseroan terbatas?" ;;
    2) Q="Berapa jumlah PT terdaftar tahun 2025?" ;;
    3) Q="Bagaimana prosedur mendirikan yayasan?" ;;
    4) Q="Siapa direktur Bank Mandiri?" ;;
    5) Q="Cari NIK 1234567812345678" ;;
  esac
  echo "=== Q$i: $Q ==="
  curl -s -H 'Content-Type: application/json' \
    -d "{\"surface\":\"public\",\"history\":[],\"message\":\"$Q\",\"sessionId\":\"rag-smoke-$i\"}" \
    https://x056.ahu-demo.chatbot-neo.val.id/api/orchestrate --max-time 120 \
    | grep -E '"delta"|"message"' | head -12
  echo
done | tee docs/superpowers/parity-snapshots/2026-07-01-rag-load/live-prod-smoke-with-rag.txt

git add docs/superpowers/parity-snapshots/2026-07-01-rag-load/live-prod-smoke-with-rag.txt
git commit -m "docs(rag): live-prod smoke shows real answers after corpus load"

/* Admin scope tokens (Plan C Phase B) — cool blue = public, warm amber
   = internal, neutral = shared. Text/icon carry the semantic meaning too;
   color is decoration only. */
.scope-public {
  --scope-color: oklch(0.63 0.14 240);
  --scope-bg: oklch(0.96 0.02 240);
  --scope-border: oklch(0.85 0.08 240);
}
.scope-internal {
  --scope-color: oklch(0.55 0.15 60);
  --scope-bg: oklch(0.97 0.03 60);
  --scope-border: oklch(0.85 0.10 60);
}
.scope-shared {
  --scope-color: oklch(0.45 0.02 260);
  --scope-bg: oklch(0.96 0.005 260);
  --scope-border: oklch(0.85 0.02 260);
}

"use client";
type Scope = "public" | "internal" | "shared";

const SCOPE_META: Record<Scope, { label: string; icon: string }> = {
  public: { label: "Publik", icon: "🌐" },
  internal: { label: "Internal", icon: "🔒" },
  shared: { label: "Bersama", icon: "⚙️" },
};

export function ScopeBadge({ scope }: { scope: Scope }): React.ReactElement {
  const meta = SCOPE_META[scope];
  return (
    <span
      className={`scope-${scope} inline-flex items-center gap-1 rounded-full px-2 py-0.5 text-xs font-medium`}
      style={{
        color: "var(--scope-color)",
        background: "var(--scope-bg)",
        border: "1px solid var(--scope-border)",
      }}
      aria-label={`Lingkup ${meta.label}`}
    >
      <span aria-hidden>{meta.icon}</span>
      <span>{meta.label}</span>
    </span>
  );
}

"use client";
import Link from "next/link";
import { ScopeBadge } from "./ScopeBadge";

type Scope = "public" | "internal" | "shared";

const SCOPE_ROOT: Record<Scope, string> = {
  public: "/admin/public",
  internal: "/admin/internal",
  shared: "/admin/shared",
};

export function ScopePill({ scope }: { scope: Scope }): React.ReactElement {
  return (
    <div className="ml-auto flex items-center gap-2">
      <ScopeBadge scope={scope} />
      <div className="flex text-xs opacity-70">
        {(["public", "internal", "shared"] as Scope[]).map((s) => (
          <Link
            key={s}
            href={SCOPE_ROOT[s]}
            className={`px-2 py-1 rounded ${s === scope ? "font-semibold underline" : "hover:opacity-100"}`}
            aria-current={s === scope ? "page" : undefined}
          >
            {s === "public" ? "Publik" : s === "internal" ? "Internal" : "Bersama"}
          </Link>
        ))}
      </div>
    </div>
  );
}

git add apps/internal-web/src/components/admin/scope/ apps/internal-web/src/app/globals.css
git commit -m "feat(admin/scope): ScopePill + ScopeBadge primitives + tokens"

// apps/internal-web/src/app/(staff)/admin/<SCOPE>/layout.tsx
import { ScopePill } from "@/components/admin/scope/ScopePill";
import { AdminNav } from "@/components/admin/AdminNav";

export default function AdminScopeLayout({ children }: { children: React.ReactNode }) {
  return (
    <div className="admin-shell scope-<SCOPE>">
      <header className="flex items-center gap-3 border-b px-4 py-2">
        <AdminNav scope="<SCOPE>" />
        <ScopePill scope="<SCOPE>" />
      </header>
      <main className="px-4 py-3">{children}</main>
    </div>
  );
}

cd /home/efran/remote-development/poc-ahu-ai/ahu-ai-chatbot/apps/internal-web/src/app/(staff)/admin
git mv knowledge internal/knowledge
git mv public-policy public/policy
mkdir -p shared/{model-gateway,provider} observe
git mv learnings observe/learnings
git mv dashboard observe/dashboard

import { redirect } from "next/navigation";
export default function AdminRoot(): never {
  redirect("/admin/internal");
}

import { NextResponse } from "next/server";
import type { NextRequest } from "next/server";

const LEGACY_MAP: Record<string, string> = {
  "/admin/knowledge": "/admin/internal/knowledge",
  "/admin/public-policy": "/admin/public/policy",
  "/admin/dashboard": "/admin/observe/dashboard",
  "/admin/learnings": "/admin/observe/learnings",
};

export function middleware(req: NextRequest) {
  const p = req.nextUrl.pathname;
  for (const [old, next] of Object.entries(LEGACY_MAP)) {
    if (p === old || p.startsWith(old + "/")) {
      const target = p.replace(old, next);
      return NextResponse.redirect(new URL(target, req.url));
    }
  }
  return NextResponse.next();
}

export const config = { matcher: ["/admin/:path*"] };

cd /home/efran/remote-development/poc-ahu-ai/ahu-ai-chatbot
pnpm --filter @ahu/internal-web build 2>&1 | tail -3

git add apps/internal-web/src/
git commit -m "refactor(admin): move admin routes under /admin/{public,internal,shared,observe}/

Adds legacy redirect middleware so bookmarked /admin/knowledge etc. still
land on the right new URL. Root /admin redirects to /admin/internal
(default staff landing)."

"use client";
import Link from "next/link";
import { usePathname } from "next/navigation";

type Scope = "public" | "internal" | "shared" | "observe";

const NAV: Record<Scope, { href: string; label: string }[]> = {
  public: [
    { href: "/admin/public/policy", label: "Kebijakan Publik" },
    { href: "/admin/public/rag", label: "Korpus RAG" },
    { href: "/admin/public/persona", label: "Prompt & Persona" },
  ],
  internal: [
    { href: "/admin/internal/knowledge", label: "Basis Pengetahuan" },
    { href: "/admin/internal/persona", label: "Prompt & Persona" },
    { href: "/admin/internal/schema", label: "Skema DB" },
  ],
  shared: [
    { href: "/admin/shared/model-gateway", label: "Model Gateway" },
    { href: "/admin/shared/provider", label: "Provider Config" },
    { href: "/admin/shared/jobs", label: "Background Jobs" },
  ],
  observe: [
    { href: "/admin/observe/dashboard", label: "Dashboard" },
    { href: "/admin/observe/threads", label: "Threads & Sessions" },
    { href: "/admin/observe/learnings", label: "Learnings" },
    { href: "/admin/observe/audit", label: "Audit Log" },
  ],
};

export function AdminNav({ scope }: { scope: Scope }): React.ReactElement {
  const p = usePathname();
  return (
    <nav aria-label={`Konsol Admin — ${scope}`} className="flex gap-1">
      {NAV[scope].map((item) => (
        <Link
          key={item.href}
          href={item.href}
          className={`px-2 py-1 text-sm rounded hover:bg-black/5 ${
            p?.startsWith(item.href) ? "font-semibold" : ""
          }`}
        >
          {item.label}
        </Link>
      ))}
    </nav>
  );
}

git add apps/internal-web/src/components/admin/AdminNav.tsx
git commit -m "feat(admin/scope): AdminNav side navigation per scope"

// apps/internal-web/src/lib/audit/store.ts
import Database from "better-sqlite3";
import { mkdirSync } from "node:fs";
import { dirname } from "node:path";

export interface AuditRow {
  id: number;
  ts: string;
  who: string;
  scope: "public" | "internal" | "shared" | null;
  action: string;
  target: string;
  before: string | null;
  after: string | null;
}

export class AuditStore {
  private db: Database.Database;
  constructor(dbPath: string) {
    mkdirSync(dirname(dbPath), { recursive: true });
    this.db = new Database(dbPath);
    this.db.exec(`
      CREATE TABLE IF NOT EXISTS audit (
        id INTEGER PRIMARY KEY AUTOINCREMENT,
        ts TEXT NOT NULL,
        who TEXT NOT NULL,
        scope TEXT,
        action TEXT NOT NULL,
        target TEXT NOT NULL,
        before TEXT,
        after TEXT
      );
      CREATE INDEX IF NOT EXISTS idx_audit_ts ON audit(ts DESC);
    `);
  }
  insert(row: Omit<AuditRow, "id" | "ts"> & { ts?: string }): AuditRow {
    const ts = row.ts ?? new Date().toISOString();
    const info = this.db
      .prepare(
        "INSERT INTO audit (ts,who,scope,action,target,before,after) VALUES (?,?,?,?,?,?,?)",
      )
      .run(ts, row.who, row.scope, row.action, row.target, row.before, row.after);
    return { id: Number(info.lastInsertRowid), ts, ...row } as AuditRow;
  }
  recent(limit: number = 100): AuditRow[] {
    return this.db
      .prepare("SELECT * FROM audit ORDER BY ts DESC LIMIT ?")
      .all(limit) as AuditRow[];
  }
}

// apps/internal-web/src/lib/audit/log.ts
import { AuditStore } from "./store";

const store = new AuditStore(process.env.AUDIT_DB ?? "/data/audit.sqlite");

export function auditLog(args: {
  who: string;
  scope: "public" | "internal" | "shared" | null;
  action: string;
  target: string;
  before?: unknown;
  after?: unknown;
}): void {
  store.insert({
    who: args.who,
    scope: args.scope,
    action: args.action,
    target: args.target,
    before: args.before !== undefined ? JSON.stringify(args.before) : null,
    after: args.after !== undefined ? JSON.stringify(args.after) : null,
  });
}

import { auditLog } from "@/lib/audit/log";
// ...inside POST:
const beforeDoc = store().getActive();
store().upsert(body);
auditLog({
  who: /* session.user.email if using next-auth, else "system" */ "system",
  scope: null, // policy is cross-scope
  action: "policy.upsert",
  target: `policy.v${body.version}`,
  before: beforeDoc,
  after: body,
});

// apps/internal-web/src/app/(staff)/admin/observe/audit/page.tsx
import { AuditStore } from "@/lib/audit/store";

export const runtime = "nodejs";

export default async function AuditPage() {
  const rows = new AuditStore(process.env.AUDIT_DB ?? "/data/audit.sqlite").recent(200);
  return (
    <section>
      <h1 className="text-lg font-semibold mb-3">Audit Log</h1>
      <table className="w-full text-sm">
        <thead>
          <tr className="text-left border-b">
            <th className="py-1">Waktu</th>
            <th>Siapa</th>
            <th>Lingkup</th>
            <th>Tindakan</th>
            <th>Target</th>
          </tr>
        </thead>
        <tbody>
          {rows.map((r) => (
            <tr key={r.id} className="border-b">
              <td className="py-1 font-mono text-xs">{r.ts}</td>
              <td>{r.who}</td>
              <td>{r.scope ?? "—"}</td>
              <td>{r.action}</td>
              <td className="font-mono text-xs">{r.target}</td>
            </tr>
          ))}
        </tbody>
      </table>
    </section>
  );
}

git add apps/internal-web/src/lib/audit/ apps/internal-web/src/app/(staff)/admin/observe/audit/ apps/internal-web/src/app/api/admin/policy/route.ts
git commit -m "feat(admin/audit): SQLite audit store + log helper + observe page

Every mutation via admin CRUD endpoints writes an audit row {who, scope,
action, target, before, after}. Recent 200 rows visible at
/admin/observe/audit."

// apps/internal-web/src/components/admin/scope/ScopePalette.tsx
"use client";
import { useEffect, useState } from "react";
import { useRouter } from "next/navigation";

const ACTIONS = [
  { label: "Switch to Public admin", href: "/admin/public" },
  { label: "Switch to Internal admin", href: "/admin/internal" },
  { label: "Switch to Shared config", href: "/admin/shared" },
  { label: "Open Audit Log", href: "/admin/observe/audit" },
  { label: "Open Dashboard", href: "/admin/observe/dashboard" },
];

export function ScopePalette(): React.ReactElement | null {
  const [open, setOpen] = useState(false);
  const [q, setQ] = useState("");
  const router = useRouter();
  useEffect(() => {
    const on = (e: KeyboardEvent) => {
      if ((e.metaKey || e.ctrlKey) && e.key.toLowerCase() === "k") {
        e.preventDefault();
        setOpen((v) => !v);
      } else if (e.key === "Escape") setOpen(false);
    };
    window.addEventListener("keydown", on);
    return () => window.removeEventListener("keydown", on);
  }, []);
  if (!open) return null;
  const filtered = ACTIONS.filter((a) => a.label.toLowerCase().includes(q.toLowerCase()));
  return (
    <div
      className="fixed inset-0 bg-black/30 grid place-items-start pt-32 z-50"
      onClick={() => setOpen(false)}
    >
      <div
        className="bg-white dark:bg-neutral-900 rounded-lg shadow-lg w-[520px] p-3"
        onClick={(e) => e.stopPropagation()}
      >
        <input
          autoFocus
          value={q}
          onChange={(e) => setQ(e.target.value)}
          placeholder="Cari perintah admin..."
          className="w-full border-b py-2 text-sm outline-none bg-transparent"
        />
        <ul className="mt-2 max-h-72 overflow-y-auto">
          {filtered.map((a) => (
            <li key={a.href}>
              <button
                className="w-full text-left px-2 py-1.5 rounded hover:bg-black/5 dark:hover:bg-white/5 text-sm"
                onClick={() => {
                  setOpen(false);
                  router.push(a.href);
                }}
              >
                {a.label}
              </button>
            </li>
          ))}
          {filtered.length === 0 && (
            <li className="px-2 py-1.5 text-xs opacity-60">Tidak ada hasil.</li>
          )}
        </ul>
      </div>
    </div>
  );
}

git add apps/internal-web/src/components/admin/scope/ScopePalette.tsx apps/internal-web/src/app/(staff)/layout.tsx
git commit -m "feat(admin/scope): Cmd+K palette to jump between scopes + audit + dashboard"

// apps/internal-web/src/lib/admin/knowledge-drift.ts
import { readFileSync, existsSync } from "node:fs";
import { createHash } from "node:crypto";
import { join } from "node:path";

function sha(buf: Buffer): string {
  return createHash("sha1").update(buf).digest("hex");
}

export function driftForTable(name: string): { drifted: boolean; publicHash: string | null; internalHash: string | null } {
  const root = process.env.KNOWLEDGE_ROOT ?? "/infra/knowledge";
  const pub = join(root, "public", "tables", `${name}.json`);
  const int = join(root, "internal", "tables", `${name}.json`);
  const p = existsSync(pub) ? sha(readFileSync(pub)) : null;
  const i = existsSync(int) ? sha(readFileSync(int)) : null;
  return { drifted: p !== null && i !== null && p !== i, publicHash: p, internalHash: i };
}

{drifted && (
  <span className="ml-2 rounded bg-amber-100 text-amber-800 text-xs px-1.5 py-0.5">drift</span>
)}

git add apps/internal-web/src/lib/admin/knowledge-drift.ts apps/internal-web/src/components/admin/knowledge/TabelDataTab.tsx
git commit -m "feat(admin/knowledge): drift indicator on tables that exist in both scopes with different content"

// apps/public-web/src/lib/orchestrator/sse-resume.ts
import IORedis from "ioredis";

const redis = new IORedis(process.env.REDIS_URL ?? "redis://localhost:6379", { maxRetriesPerRequest: null });
const TTL_SECONDS = 300; // 5 minutes — enough for reconnect

export interface CheckpointEntry {
  id: string;
  event: string;
  data: string;
}

export async function appendCheckpoint(sessionId: string, entry: CheckpointEntry): Promise<void> {
  const key = `sse:resume:${sessionId}`;
  await redis
    .multi()
    .rpush(key, JSON.stringify(entry))
    .expire(key, TTL_SECONDS)
    .exec();
}

export async function since(sessionId: string, lastEventId: string | null): Promise<CheckpointEntry[]> {
  const key = `sse:resume:${sessionId}`;
  const raw = await redis.lrange(key, 0, -1);
  const all = raw.map((r) => JSON.parse(r) as CheckpointEntry);
  if (!lastEventId) return [];
  const idx = all.findIndex((e) => e.id === lastEventId);
  return idx >= 0 ? all.slice(idx + 1) : [];
}

git add apps/public-web/src/lib/orchestrator/sse-resume.ts
git commit -m "feat(orchestrator/sse-resume): Redis-backed event-id checkpoint list per session"

function event(name: string, data: Record<string, unknown> = {}, id?: string): string {
  const payload = JSON.stringify(data);
  const idLine = id ? `id: ${id}\n` : "";
  return `${idLine}event: ${name}\ndata: ${payload}\n\n`;
}
// Update each exported function to accept + forward id, e.g.:
export const status = (text: string, id?: string) => event("status", { text }, id);

import { appendCheckpoint } from "./sse-resume";

// Inside runOrchestrator, wrap each `yield sse.X(...)` with:
let seq = 0;
const emit = async (chunk: string, name: string, payload: Record<string, unknown>): Promise<string> => {
  const id = `${req.sessionId}-${++seq}`;
  await appendCheckpoint(req.sessionId, { id, event: name, data: JSON.stringify(payload) });
  return chunk;
};
// Replace `yield sse.status(txt)` with:
yield await emit(sse.status(txt, `${req.sessionId}-${seq + 1}`), "status", { text: txt });

// apps/public-web/tests/orchestrator/sse-resume.test.ts
import { describe, it, expect } from "vitest";
import { appendCheckpoint, since } from "../../src/lib/orchestrator/sse-resume";

describe("sse-resume", () => {
  it("appends + retrieves entries since a checkpoint id", async () => {
    const sid = `t-${Date.now()}`;
    await appendCheckpoint(sid, { id: "e1", event: "content", data: '{"delta":"a"}' });
    await appendCheckpoint(sid, { id: "e2", event: "content", data: '{"delta":"b"}' });
    const s = await since(sid, "e1");
    expect(s.length).toBe(1);
    expect(s[0].id).toBe("e2");
  });
});

cd apps/public-web && pnpm vitest run tests/orchestrator/sse-resume.test.ts
git add apps/public-web/src/lib/orchestrator/{orchestrate,sse,sse-resume}.ts apps/public-web/tests/orchestrator/sse-resume.test.ts
git commit -m "feat(orchestrator): checkpoint every SSE event to Redis for resume"

import { since } from "@/lib/orchestrator/sse-resume";

export async function POST(req: Request): Promise<Response> {
  // ...existing parse + validate...
  const lastEventId = req.headers.get("Last-Event-ID");

  const stream = new ReadableStream<Uint8Array>({
    async start(controller) {
      const enc = new TextEncoder();
      if (lastEventId) {
        const missed = await since(body.sessionId, lastEventId);
        for (const e of missed) {
          controller.enqueue(enc.encode(`id: ${e.id}\nevent: ${e.event}\ndata: ${e.data}\n\n`));
        }
      }
      for await (const chunk of runOrchestrator(body)) {
        controller.enqueue(enc.encode(chunk));
      }
      controller.close();
    },
  });
  // ...existing headers...
}

git add apps/public-web/src/app/api/orchestrate/route.ts
git commit -m "feat(api/orchestrate): honor Last-Event-ID header for SSE resume"

let lastId: string | null = null;

git add packages/streams/src/native-provider.ts
git commit -m "feat(streams): reconnect with Last-Event-ID on premature SSE close (3 retries, exponential backoff)"

const commonHeaders = {
  "X-Tenant-Id": "ahu-chatbot",
  "X-Surface": req.surface,
  "X-User-Id": req.sessionId, // proxy for user until public auth lands
};

// In each plan/evaluate/compose call:
await planning.completeJson(msgs, { headers: { ...commonHeaders, "X-Priority": "planning" } });
// ...
for await (const delta of synthesis.stream(msgs, { headers: { ...commonHeaders, "X-Priority": "synthesis" } })) { ... }

git add apps/public-web/src/lib/orchestrator/orchestrate.ts apps/public-web/tests/orchestrator/orchestrate.test.ts
git commit -m "feat(orchestrator): emit X-Tenant-Id + X-Surface + X-User-Id + X-Priority headers on every LLM call"

// apps/internal-web/src/workers/eval-nightly.ts
import { makeWorker } from "@ahu/queue";

interface EvalJob { agent: "public" | "internal"; limit?: number }

makeWorker<EvalJob>("nightly-eval", async ({ data }) => {
  const { agent, limit = 5 } = data;
  const url = agent === "public" ? "http://public-agent:8000" : "http://internal-agent:8000";
  // Fire evaluation queries; capture outputs to /data/eval-runs/<date>.json
  console.log(`[eval-nightly] running ${limit} cases against ${url}`);
  // ... actual eval logic (fetch loop) ...
});

# infra/compose.workers.yaml
services:
  ahu-workers:
    image: ahu-ai-chatbot-internal:${IMAGE_TAG:-latest}
    container_name: ahu-ai-workers
    restart: unless-stopped
    command: ["node", "apps/internal-web/dist/workers/eval-nightly.js"]
    env_file:
      - env/shared.env
      - env/internal.env
    networks:
      - gateway-net
      - ahu-net

networks:
  gateway-net:
    external: true
    name: ahu-gateway-net
  ahu-net:
    external: true

git add apps/internal-web/src/workers/eval-nightly.ts infra/compose.workers.yaml
git commit -m "feat(workers): nightly eval worker + workers compose stack"

// apps/internal-web/src/workers/knowledge-reingest.ts
import { makeWorker } from "@ahu/queue";

interface ReingestJob { collection: string; sourceDir: string }

makeWorker<ReingestJob>("knowledge-reingest", async ({ data }) => {
  const res = await fetch(`http://ai-ahu-rag:8110/admin/ingest?collection=${data.collection}&source=${data.sourceDir}`, {
    method: "POST",
  });
  if (!res.ok) throw new Error(`ingest failed: HTTP ${res.status}`);
});

git add apps/internal-web/src/workers/knowledge-reingest.ts infra/compose.workers.yaml
git commit -m "feat(workers): knowledge re-ingestion worker (calls ai-ahu-rag /admin/ingest)"

// apps/internal-web/src/app/api/admin/jobs/route.ts
import { NextResponse } from "next/server";
import { makeQueue } from "@ahu/queue";

const q = makeQueue("nightly-eval");

export const runtime = "nodejs";

export async function GET() {
  const active = await q.getActive();
  const completed = await q.getCompleted(0, 20);
  return NextResponse.json({ active, completed });
}

export async function POST(req: Request) {
  const body = (await req.json()) as { name: string; data: unknown };
  const job = await q.add(body.name, body.data);
  return NextResponse.json({ jobId: job.id });
}

git add apps/internal-web/src/app/api/admin/jobs/ apps/internal-web/src/app/\(staff\)/admin/shared/jobs/
git commit -m "feat(admin/jobs): admin UI to trigger + view BullMQ jobs"

cd apps/public-web
pnpm add node-sql-parser

// apps/public-web/src/lib/orchestrator/sql-guard/validator.ts
import { Parser } from "node-sql-parser";

const AGGREGATE_FNS = new Set(["COUNT", "SUM", "AVG", "MIN", "MAX", "MEDIAN", "STDDEV", "VARIANCE"]);

export interface ValidatorConfig {
  allowed_tables: Set<string>;
  pre_aggregated_tables: Set<string>;
  disallowed_columns: Set<string>;
  dialect: "mysql" | "postgres";
}

export class ValidationError extends Error {}

const norm = (s: string | null | undefined): string => (s ?? "").trim().toLowerCase();

export function validate(sql: string, cfg: ValidatorConfig): void {
  const parser = new Parser();
  let ast: any;
  try {
    ast = parser.astify(sql, { database: cfg.dialect });
  } catch (e) {
    throw new ValidationError(`parse error: ${(e as Error).message}`);
  }
  const stmts = Array.isArray(ast) ? ast : [ast];
  if (stmts.length !== 1) throw new ValidationError("must be exactly one statement");
  const s = stmts[0];
  if (s.type !== "select") throw new ValidationError(`non-SELECT statement: ${s.type}`);

  // No SELECT *
  for (const col of s.columns ?? []) {
    if (col.expr?.type === "star") throw new ValidationError("SELECT * is not permitted");
  }

  // Collect referenced tables + columns
  const tables = new Set<string>();
  const cols = new Set<string>();
  const walk = (node: any) => {
    if (!node || typeof node !== "object") return;
    if (node.table) tables.add(norm(node.table));
    if (node.column) cols.add(norm(node.column));
    for (const k of Object.keys(node)) if (typeof node[k] === "object") walk(node[k]);
  };
  walk(s);

  // Table allowlist
  const badTables = [...tables].filter((t) => !cfg.allowed_tables.has(t));
  if (badTables.length) throw new ValidationError(`table not in allowlist: ${badTables.sort()}`);

  // Disallowed columns
  const badCols = [...cols].filter((c) => cfg.disallowed_columns.has(c));
  if (badCols.length) throw new ValidationError(`disallowed column referenced: ${badCols.sort()}`);

  // No LIMIT 1
  if (s.limit?.value?.[0]?.value === 1) throw new ValidationError("LIMIT 1 / single-row pattern blocked");

  // Non-pre-aggregated table requires aggregate function
  const nonPreAgg = [...tables].filter((t) => !cfg.pre_aggregated_tables.has(t));
  if (nonPreAgg.length > 0) {
    const hasAgg = (s.columns ?? []).some((c: any) => {
      const walk2 = (n: any): boolean => {
        if (!n || typeof n !== "object") return false;
        if (n.type === "aggr_func" && AGGREGATE_FNS.has(String(n.name).toUpperCase())) return true;
        return Object.values(n).some((v) => walk2(v));
      };
      return walk2(c.expr);
    });
    if (!hasAgg) throw new ValidationError("query against non-aggregated table requires an aggregate function");
  }
}

import { describe, it, expect } from "vitest";
import { validate, ValidationError, type ValidatorConfig } from "../../src/lib/orchestrator/sql-guard/validator";

const cfg: ValidatorConfig = {
  allowed_tables: new Set(["tbl_perseroan", "summary_jumlah_transaksi"]),
  pre_aggregated_tables: new Set(["summary_jumlah_transaksi"]),
  disallowed_columns: new Set(["nik", "nama", "alamat"]),
  dialect: "mysql",
};

describe("sql-guard validator", () => {
  it("accepts aggregate SELECT on allowed table", () => {
    expect(() => validate("SELECT COUNT(*) FROM tbl_perseroan", cfg)).not.toThrow();
  });
  it("accepts SELECT on pre-aggregated table without aggregate", () => {
    expect(() => validate("SELECT total FROM summary_jumlah_transaksi", cfg)).not.toThrow();
  });
  it("rejects SELECT *", () => {
    expect(() => validate("SELECT * FROM tbl_perseroan", cfg)).toThrow(ValidationError);
  });
  it("rejects unknown table", () => {
    expect(() => validate("SELECT COUNT(*) FROM tbl_secret", cfg)).toThrow(/allowlist/);
  });
  it("rejects disallowed column", () => {
    expect(() => validate("SELECT nik FROM tbl_perseroan", cfg)).toThrow(/disallowed/);
  });
  it("rejects LIMIT 1", () => {
    expect(() => validate("SELECT COUNT(*) FROM tbl_perseroan LIMIT 1", cfg)).toThrow(/LIMIT 1/);
  });
  it("rejects non-aggregate on non-pre-agg table", () => {
    expect(() => validate("SELECT tahun FROM tbl_perseroan", cfg)).toThrow(/aggregate function/);
  });
});

pnpm vitest run tests/orchestrator/sql-guard.test.ts
git add apps/public-web/src/lib/orchestrator/sql-guard/ apps/public-web/tests/orchestrator/sql-guard.test.ts apps/public-web/package.json pnpm-lock.yaml
git commit -m "feat(orchestrator/sql-guard): TS port of validator (Plan A deferred item #7)"

// apps/public-web/src/lib/orchestrator/sql-guard/result-filter.ts
export interface FilterConfig {
  disallowed_columns: Set<string>;
  k_anonymity_min: number;
  max_rows: number;
  aggregate_count_columns: Set<string>;
}

export class FilteredOut extends Error {}

const norm = (s: string): string => s.trim().toLowerCase();

export interface FilteredResult {
  columns: string[];
  rows: unknown[][];
  suppressed_count: number;
  truncated: boolean;
}

export function filterResult(
  columns: string[],
  rows: unknown[][],
  cfg: FilterConfig,
): FilteredResult {
  const normCols = columns.map(norm);
  const bad = normCols.filter((c) => cfg.disallowed_columns.has(c));
  if (bad.length > 0) throw new FilteredOut(`disallowed column in result schema: ${bad.sort()}`);
  const countIdx = normCols.findIndex((c) => cfg.aggregate_count_columns.has(c));
  let suppressed = 0;
  let filtered = rows;
  if (countIdx >= 0) {
    filtered = rows.filter((r) => {
      const v = Number(r[countIdx]);
      if (Number.isFinite(v) && v < cfg.k_anonymity_min) {
        suppressed++;
        return false;
      }
      return true;
    });
  }
  const truncated = filtered.length > cfg.max_rows;
  return {
    columns: [...columns],
    rows: truncated ? filtered.slice(0, cfg.max_rows) : filtered,
    suppressed_count: suppressed,
    truncated,
  };
}

import { describe, it, expect } from "vitest";
import { filterResult, FilteredOut } from "../../src/lib/orchestrator/sql-guard/result-filter";

const base = {
  disallowed_columns: new Set(["nik"]),
  k_anonymity_min: 10,
  max_rows: 5,
  aggregate_count_columns: new Set(["total", "count", "jumlah"]),
};

describe("filterResult", () => {
  it("rejects schema with disallowed column", () => {
    expect(() => filterResult(["nik", "tahun"], [[1, 2020]], base)).toThrow(FilteredOut);
  });
  it("suppresses rows with count < k_anonymity_min", () => {
    const out = filterResult(["provinsi", "total"], [["JATIM", 5], ["JABAR", 100]], base);
    expect(out.suppressed_count).toBe(1);
    expect(out.rows.length).toBe(1);
  });
  it("truncates when rows > max_rows", () => {
    const rows = Array.from({ length: 8 }, (_, i) => ["p", i * 100]);
    const out = filterResult(["provinsi", "total"], rows, base);
    expect(out.truncated).toBe(true);
    expect(out.rows.length).toBe(5);
  });
});

pnpm vitest run tests/orchestrator/result-filter.test.ts
git add apps/public-web/src/lib/orchestrator/sql-guard/result-filter.ts apps/public-web/tests/orchestrator/result-filter.test.ts
git commit -m "feat(orchestrator/sql-guard): TS port of result_filter (k-anon + row cap)"

git add packages/streams/src/native-provider.ts packages/streams/tests/native-provider-modes.test.ts
git commit -m "refactor(streams): native-provider around explicit single/dual state machine

Replaces implicit-boolean dualMode detection with a typed StreamMode +
pipeline routing. Adds test coverage for both modes independently."

grep -n "os.environ\|getenv" apps/internal-agent/dash/evals/run_model_comparison.py | head -20

import os
API_KEY = os.environ.get("SYNTHESIS_API_KEY") or os.environ.get("DASHSCOPE_API_KEY")
GATEWAY = os.environ.get("MODEL_GATEWAY_URL", "http://ahu-vllm:8000")

ssh obert@192.168.83.20 "docker exec ahu-ai-agent-public sh -c 'cd /repo/apps/public-agent && python -m dash.evals.run_model_comparison --limit 2'"

git add apps/public-agent/dash/evals/run_model_comparison.py apps/internal-agent/dash/evals/run_model_comparison.py
git commit -m "fix(evals): unify env schema with orchestrator (SYNTHESIS_API_KEY, MODEL_GATEWAY_URL)"

lsof /home/efran/remote-development/poc-ahu-ai/ai-ahu-chatbot 2>&1 | head
docker ps --format '{{.Names}} {{.Mounts}}' | grep ai-ahu-chatbot

cd /home/efran/remote-development/poc-ahu-ai
rm ahu-ai-chatbot  # symlink
mv ai-ahu-chatbot ahu-ai-chatbot

git -C /home/efran/remote-development/poc-ahu-ai/ahu-ai-chatbot status

git -C /home/efran/remote-development/poc-ahu-ai/ahu-ai-chatbot commit --allow-empty -m "chore: physical rename ai-ahu-chatbot → ahu-ai-chatbot (symlink removed)"

grep -rln "ai-ahu-chatbot" /home/efran/remote-development/poc-ahu-ai/ahu-ai-chatbot/infra/ /home/efran/remote-development/poc-ahu-ai/ahu-ai-chatbot/apps/*/scripts/ | head

# From anywhere with LAN access:
curl -sf https://x056.ahu-demo.chatbot-neo.val.id/api/health
curl -N -H 'Content-Type: application/json' \
  -d '{"surface":"public","history":[],"message":"Apa itu perseroan terbatas?","sessionId":"final-1"}' \
  https://x056.ahu-demo.chatbot-neo.val.id/api/orchestrate --max-time 60 | grep -c '"delta"'
# Expected: real Indonesian answer with references; delta count > 10

cd /home/efran/remote-development/poc-ahu-ai/ahu-ai-chatbot
pnpm typecheck
pnpm test
uv run pytest tests/isolation -v
ls /home/efran/remote-development/poc-ahu-ai/ | grep -E "^(ai-ahu|ahu-ai)-chatbot$"
# Expected: only ahu-ai-chatbot listed